VAPT cost in India: a 2026 price guide
What a vulnerability assessment and penetration test costs in India, what moves the price, where BERRY9's starting prices sit, and what other vendors publish, with every market figure named by source and date.
- Starter scope from
- INR 9,000 + GST
- Every other test from
- INR 27,000 + GST
- Market figures read on
- 30 October 2026
- BERRY9 prices shown
- Before 18% GST
Last reviewed
Starter scope: INR 9,000 + 18% GST, for small scopes such as a simple WordPress website or a few external IP addresses.
Every other test: from INR 27,000 + 18% GST. The final price follows the scope, set in the scoping conversation.
Every market figure on this page is named by source and the date it was read.
01 / What you pay for
What a VAPT price is made of
A VAPT price is mostly a measure of time. A vulnerability assessment and penetration test is skilled work done by people, and what a vendor charges reflects how many tester-days the scope needs, plus the tooling, the report and the follow-up that come with it. Two proposals with very different figures can both be fair if they describe different amounts of work, which is why the scope matters more than the headline number.
Most proposals are built from five pieces of work:
Step 1
Scoping
A conversation, or a short questionnaire, that pins down what will be tested, from where, and under which rules. Every other line of the price depends on it, so a loose scope makes any figure hard to compare.
Step 2
Automated scanning
Scanners sweep the assets for known weaknesses, outdated software and common misconfigurations. Some guides price scans and manual tests separately and some do not, so check which one a figure describes.
Step 3
Manual testing
A tester works through the application or network by hand: signing in under each role, trying to reach data that belongs to someone else, chaining small weaknesses into a real attack path, and confirming that each finding is genuine. This is where most of the hours, and so most of the money, go.
Step 4
Reporting
Each confirmed finding is written up with its impact, the steps to reproduce it and a recommended fix. A report meant for an auditor or an enterprise customer usually needs a management summary and a clear statement of what was in scope as well.
Step 5
Fix verification
After your team fixes the findings, the tester checks that each fix holds. Some vendors include this follow-up check; others price it separately or limit how many rounds you get.
When you read a price, ask how it splits across these pieces. A figure that is almost all scanning describes a different service from one that is mostly manual testing, even when both are sold under the name VAPT.
02 / Price drivers
What drives the price of a VAPT
Inside those pieces of work, a handful of factors decide how many hours a test needs. These are the questions any vendor has to answer before it can put a figure on the job.
Assets in scope
One web application, a mobile app with its API, an office network and a cloud account are separate pieces of work. Each asset added to the scope adds testing time.
Roles
In an application with logins, each role, such as customer, staff member, administrator or partner, is its own set of permissions. Checking that one role cannot do what only another role is allowed to do is slow, careful work, and it grows with every role you add.
Endpoints
The number of pages, functions and API calls sets how many inputs a tester has to work through. An API with a dozen endpoints and one with several hundred are very different jobs.
Hosts
On a network test, each server, device or IP address is something to enumerate and probe. That is why some vendors price network work per IP address.
Environments
Testing staging and production, or several regions or tenant configurations, repeats part of the work. Agreeing which environment is tested, and when, often trims the scope without weakening the result.
Depth of manual testing
A scan with a light manual check, a time-boxed manual test and a deep test that follows every attack path can all be sold as VAPT. The deeper the manual work, the higher the price.
Follow-up checks
Whether a check of your fixes is included, how many rounds, and how long after the first report it can be used all change the total.
Reporting for auditors
When the report has to satisfy an auditor or a customer's security team, for example in SOC 2, ISO 27001 or PCI DSS work, it may need a formal scope statement, evidence for each finding and a summary for management. That takes time to write and review.
Access plays a part too. External tests reach your systems over the internet, while internal tests need a VPN credential, a jump host or a laptop placed on your network. If that access takes days to arrange, the schedule stretches, so it pays to have it ready before testing begins.
03 / BERRY9 prices
BERRY9 starting prices
BERRY9 publishes two starting prices.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
It is meant for small, well-defined targets.
- A vulnerability scan
- Manual checks
- A written report
Every other test
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST. That covers:
- A web application with logins and roles
- A mobile app with its backend
- An API
- An internal network
- An Active Directory domain
- A source code review
- Tests run for SOC 2, ISO 27001 or PCI DSS work
Both figures are starting prices, and 18% GST is added to each. Larger scopes cost more: more roles, endpoints, hosts or environments mean more testing time, and the price follows the time. The figure for your environment is set in a written proposal after a scoping conversation, once it is clear what is being tested.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
04 / Market figures
What the market publishes
Several vendors publish VAPT price guides for India.
Show details for What the market publishes
The figures here come from those guides as read on 30 October 2026, with the date where the source gives one. They are vendor marketing figures, not audited averages: every vendor defines its own scopes, and several of the guides also promote the publisher's own plans. Read them as a sense of the market rather than a price list. Rupee figures are before GST unless the source says otherwise.
Indian sources
| Source | Date | Figure | What it covers |
|---|---|---|---|
| Astra Security | Updated 17 February 2026 | INR 40,000 to INR 8,50,000 | One scan of a website or mobile appFrom its VAPT pricing guide |
| Astra Security | Updated 17 February 2026 | INR 40,000 to INR 2,50,000 | A manual test of a single web application |
| Astra Security | Updated 17 February 2026 | INR 3,80,000 to INR 5,50,000 | Networks and infrastructure, for simple to sophisticated setups |
| Astra Security | Updated 17 February 2026 | INR 8,50,000 to INR 12,50,000 | Networks and infrastructure, for complex setups |
| Astra Security | Updated 17 February 2026 | Up to INR 25,00,000 | Networks and infrastructure, for large setups |
| Astra Security | Updated 17 February 2026 | INR 1,67,000, INR 5,00,000 and INR 6,65,000 | Astra's own yearly plans: its scanner, its pentest plan and its enterprise plan |
| Astra SecuritySeparate page on website security audit costs | 2026, seen as a search excerpt | INR 2,00,000 to INR 12,50,000 | The manual penetration testing phase of an auditIt says the overall audit starts at INR 35,000 |
| BM Infotrade | Modified 21 July 2026 | INR 30,000 to INR 7,50,000 | One scan of a website or mobile app |
| BM Infotrade | Modified 21 July 2026 | INR 1,000 to INR 5,000 an IP address | Network testing, priced per IP addressIt works this out at INR 20,000 to INR 1,00,000 for 20 addresses |
| BM Infotrade | Modified 21 July 2026 | INR 25,000 to INR 2,50,000 each | ApplicationsA basic brochure website at about INR 25,000; a simple banking application above INR 2,50,000 |
| CybersecifyIts 2026 India cost guide and its pricing page | 2026 | INR 50,000 to INR 15 lakh | Pentests in India, in three bands: budget at INR 50,000 to INR 1 lakh, professional at INR 1 lakh to 3 lakh, and the highest band, at INR 3 lakh to 15 lakh and more |
| Cybersecify | 2026 | INR 74,999 and INR 1,79,999 | Its own plans: one scope, taking about six business days, and its growth plan |
| Cybersecify | 2026 | INR 75,000 | The floor it names for a manual test an auditor will accept |
| 3.0 University | 2 July 2026 | INR 50,000 to INR 5,00,000 | Per assessment, depending on the scope and the number of assets |
| ECS Infotech | 2025 | INR 2 lakh to 5 lakh | Testing a small business, covering network and application work |
| ECS Infotech | 2025 | INR 5 lakh to 25 lakh | A medium business, covering network and application work |
Figures published in US dollars
Figures from abroad do not translate directly into Indian prices, because rates, scopes and taxes differ, but they show how the same kinds of test are priced elsewhere. They are given in US dollars, as published, for reference only.
| Source | Date | Figure | What it covers |
|---|---|---|---|
| Ostorlab | September 2026 | US$3,000 to US$18,000 | A manual test of one web application or API |
| Ostorlab | September 2026 | US$18,000 to US$50,000 and more | Web, API, mobile and cloud tested together |
| Ostorlab | September 2026 | US$499 to about US$8,000 | Automated "AI pentest" packages |
| BSG | 2026 | US$4,000 to US$6,000 | An external network test of a small environment of no more than 50 IP addresses |
| Invadel | No date given | From US$4,200 | An external networkFixed starting price on its site |
| Invadel | No date given | From US$5,200 | A web applicationFixed starting price on its site |
| Invadel | No date given | From US$6,000 | A mobile app on both platformsFixed starting price on its site |
| Invadel | No date given | From US$4,000 | An APIFixed starting price on its site |
| Invadel | No date given | From US$4,800 | Secure code reviewFixed starting price on its site |
| Invadel | No date given | From US$1,500 | Vulnerability scanningFixed starting price on its site |
| SecureLayer7 | 2026 | From US$3,500 | VAPT, in its article on VAPT companies in India |
| Blaze InfoSec, Stingrai and Invicti | 2026 | US$5,000 to US$30,000 | Mobile application tests |
| Blaze InfoSec, Stingrai and Invicti | 2026 | US$4,000 to US$20,000 | API tests |
Read side by side, the Indian guides put the starting point for a manual test of one scope at around INR 40,000 to INR 75,000, with large, complex or audit-driven work running into many lakhs. Some guides price scans and manual tests separately and some do not, so check which one a figure describes before comparing it with anything else.
05 / Where BERRY9 sits
Where BERRY9's starting prices sit
Set against those published figures, BERRY9's starter price of INR 9,000 + 18% GST is low.
Show details for Where BERRY9's starting prices sit
That price sits below what most of these vendors publish as a starting point for a manual test, which on their own figures begins at around INR 40,000 to INR 75,000 for one scope. Starting prices are not like-for-like, though, because each vendor's scope, depth of testing and reporting differ. The nearest published figure is BM Infotrade's per-address network pricing: at INR 1,000 to INR 5,000 an IP address, 3 to 5 addresses would come to INR 3,000 to INR 25,000, and its basic brochure website sits at about INR 25,000.
The starter price
The starter price is low because the scope is small. It covers a handful of external IP addresses or a simple WordPress website, and nothing larger. It is a starting point for small, contained targets, not a compliance-grade test of a full application.
The standard starting price
The standard starting price of INR 27,000 + 18% GST, which applies to every other test, is also toward the lower end of what the Indian guides publish. It too is a starting point. A web application with many roles, an API with several hundred endpoints, a network spread over several sites, or a test whose report has to satisfy an auditor will cost more than the starting figure.
When an audit drives the test
If an audit is driving the test, the scope and the report matter more than any starting price. Cybersecify's guide, for example, puts the floor for a manual test an auditor will accept at INR 75,000. Whatever the figure, the deciding question is whether the scope and the report meet what your auditor has asked for, so share that requirement before scoping and check that the proposal answers it.
06 / Comparing proposals
How to compare VAPT proposals
Comparing proposals on the headline figure alone tends to mislead, because two vendors can describe the same target and price very different amounts of work. These checks make the figures comparable.
Show details for How to compare VAPT proposals
- Line up the scope. List the assets, roles, endpoints, hosts and environments each proposal covers. If one proposal tests the production web application and another tests only staging, they are not pricing the same job.
- Look for the testing time. A proposal that states the number of tester-days, or the length of the testing window, lets you compare effort directly. If none is stated, ask for it.
- Separate scanning from manual testing. Check how much of the work is done by hand. An automated scan has its uses, but it will not find the authorization and business-logic flaws that manual testing exists to catch.
- Read the retest terms. Note whether a retest is included, how many rounds, and whether there is a deadline for using it.
- Ask for a sample report. The report is what you keep once the test is over. A sample shows whether findings come with reproduction steps, impact and a fix, and whether there is a summary your management and your auditor can read. Our sample VAPT report shows the format BERRY9 uses.
- Put the tax on the same footing. Check whether each figure includes GST. A price shown before 18% GST and one shown after it differ by almost a fifth.
- Check the schedule. Make sure the testing window and the report date fit the deadline you are working to, such as an audit date or a customer's security review.
For a fuller checklist on picking a firm, read how to choose a VAPT company in India.
07 / Vendor questions
What to ask a VAPT vendor
Before you sign, put these questions to every vendor on your shortlist, BERRY9 included. Clear, specific answers are a good sign; vague ones are worth pressing on.
Show details for What to ask a VAPT vendor
- Scope definition. Exactly which assets, roles, endpoints, hosts and environments are in scope, and what is left out? Will the scope be written into the proposal?
- Manual or automated. How much of the test is done by hand, and how much by scanners? Which tools are used, and who checks their output before it reaches the report?
- Retest terms. Is a retest included? How many rounds, how soon after the report, and is there a further charge?
- Report contents. Can we see a sample report? Does each finding include reproduction steps, impact and a recommended fix? Is there a summary for management?
- Tester experience. Who will do the testing? What experience do they have with systems like ours, and will the same people walk us through the findings?
- Data handling. How will our credentials, test data and findings be stored and shared during the test, and what happens to them afterwards? Is a non-disclosure agreement signed before work starts?
- Auditor requirements. Will the work and the report satisfy what our auditor or customer has asked for? If SOC 2, ISO 27001 or PCI DSS is involved, share the auditor's requirement and ask the vendor to confirm in writing how the test meets it.
- Schedule. When can testing start, how long will it take, and when will the report arrive?
08 / How we work
How BERRY9 works
Show details for How BERRY9 works
Every BERRY9 test starts with a scoping conversation and is run by our engineers from our Hyderabad office; the starter scope includes manual checks and a written report, and every other test is manual-led and ends with an executive report and an engineering report; the VAPT methodology sets out each phase, and each service page covers one test in detail.
09 / Inquiry
Send your scope and timeline
Tell us what you want tested, where it runs and when you need the report, and we will propose a scope and timeline, with the price for that scope written into the proposal. To talk it through first, call +91 86868 92922 or write to contact@berry9.com.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Why do VAPT prices vary so much in India?
Because vendors are pricing different amounts of work. The number of assets, roles, endpoints, hosts and environments, the depth of manual testing, any follow-up check of fixes and the reporting an auditor needs all change the testing time. Some guides also price scans and manual tests separately and some do not, so check which one a figure describes. See the section on What drives the price of a VAPT above.
How much does VAPT cost for a small website?
At BERRY9, a simple WordPress website falls in the starter scope, which starts from INR 9,000 + 18% GST. A website with logins and roles is a web application test, which starts from INR 27,000 + 18% GST. BM Infotrade's guide (July 2026) puts a basic brochure website at about INR 25,000. See the section on BERRY9 starting prices above.
Do you charge per IP address?
BERRY9 prices a network test by its scope rather than publishing a rate per IP address. A small external scope of 3 to 5 IP addresses falls in the starter scope, from INR 9,000 + 18% GST; larger networks start from INR 27,000 + 18% GST, and the number of hosts is one of the things that sets the final figure. Some vendors do publish per-address rates, such as BM Infotrade at INR 1,000 to INR 5,000 an IP address (July 2026).
Is GST extra on VAPT prices?
Yes. Every BERRY9 price is shown before GST, and 18% GST is added to it. The market figures in the BERRY9 cost guide are also given before GST unless the source says otherwise, so check how each vendor shows its figure before comparing.
What is not included in the starting price?
GST at 18%, which is added to every price. Beyond that, the starter price covers only a small scope, such as 3 to 5 external IP addresses or a simple WordPress website. Anything larger, such as an application with logins and roles, an API or an internal network, is a separate test that starts from INR 27,000 + 18% GST. See the section on BERRY9 starting prices above.
How long does a VAPT take?
At BERRY9, typical scopes take 5 to 10 working days, counted from kickoff. Larger estates, such as several applications tested together or a network spread over several sites, take longer, and the proposal sets out the schedule.
Are the published market figures average prices?
No. They are figures vendors publish in their own price guides, which makes them marketing figures rather than audited averages. Each vendor defines its scopes differently, so they give a sense of the market, not a benchmark for any one test. See the section on What the market publishes above.
Will a test at the starting price satisfy an auditor?
That depends on what your auditor asks for. The starter scope is meant for small, well-defined targets; a test that has to support SOC 2, ISO 27001 or PCI DSS work often needs a wider scope and a fuller report, which costs more. Share the auditor's requirement before scoping so the proposal covers it. See the section on Where BERRY9's starting prices sit above.